Enterprises are known to employ strong authentication techniques to protect the confidentiality, integrity and assured service of their data and information technology. This has been accomplished using a variety of methods, including issuing a digital certificate to each employee, providing a token to each employee, etc. Strong authentication for an enterprise can be relatively straightforward to implement because there is generally a single entity to which a controlled group of users must authenticate themselves, i.e., the enterprise itself.
It can be difficult to apply strong authentication techniques for consumer applications. Digital certificates and tokens can be perceived as an encumbrance to the consumer's interaction with other entities, such as merchants, and can be an expense that neither the consumer nor the other entity is willing to bear. However, the consumer's willingness to adopt certain strong authentication techniques can be expected to grow in view of the increasingly sophisticated and damaging threat posed by hackers, such as identity theft, phishing, man-in-the-middle attacks and credit card theft. This is further accentuated by the increasing amount of commerce and other activities that take place online each year.
Indeed, the unanswered threat of compromise and the resultant accumulation of negative events can itself be considered a modern impediment to the continued migration of consumer activities to an online environment. Although stronger authentication is needed for the consumer, certain known solutions can be difficult to implement. For example, unlike most enterprise clients, a consumer must authenticate itself to a broad range of diverse entities. A consumer typically may not want to keep track of a different authentication credentials that are associated with different entities. For example, many consumers have multiple bank, credit card, service provider, healthcare and government accounts. Each of these could benefit from strong authentication by the consumer. In this case, if the consumer is issued one authentication device per account, he or she may potentially have a pocket or key ring full of devices. This may be undesirable to the consumer.
What is needed is an authentication system and method that can operate using a shared token that can be used by the consumer to authenticate himself to a wide variety of enterprises. If a single token can be shared across many sites, then it is much more likely that the consumer will begin to carry it around as a necessary personal tool much like a cell phone, car keys or credit cards.